CVE-2026-74791
Received Received - Intake

Scriban Template Context Cache Persistence Vulnerability

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-74791
EUVD
EUVD-2026-59957

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scriban scriban to 7.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-226 The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Scriban before version 7.0.0 fails to clear cached templates when TemplateContext.Reset() is called. This allows previously authorized template content to persist across different contexts. Attackers can exploit request-dependent template loaders to access sensitive template data without reloading it.

Detection Guidance

Check Scriban version with command: grep -r "Scriban" your_project_file | grep -i version. If version is below 7.0.0, the system is vulnerable. Review application code for TemplateContext.Reset() usage and ITemplateLoader implementations.

Impact Analysis

This vulnerability allows unauthorized access to sensitive template content across different requests or users. If your application reuses TemplateContext objects and uses request-dependent template loaders, attackers could view admin-only or other restricted template data without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of restricted template content may result in non-compliance with data access and protection regulations.

Mitigation Strategies

Upgrade Scriban to version 7.0.0 or later. If upgrading is not possible, modify code to manually clear CachedTemplates after Reset() or avoid reusing TemplateContext objects. Review all template includes for sensitive data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74791. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart